Lightning's Third Toolkit Patches
The Lightning Development Kit, a software library used to build mobile Lightning wallets and payment services, released v0.2.6 on September 9 fixing two flaws: one allowing a malicious channel partner to divert small amounts through excess fees during a channel top-up (splice), and one that could prevent a node's saved state from loading on restart, per the release as covered by CryptoSlate. No losses were reported. The update follows August's security patches in LND and Core Lightning — the third major Lightning implementation to fix security-relevant bugs within a month.
Lightning Bugs: no leader means no recall
Two flaws in LDK — the toolkit inside many Lightning mobile wallets.
One let a scheming trading partner skim a little of your money through inflated fees when you top up a payment channel.
The other could stop your wallet's engine restarting after a shutdown.
No losses reported. The fix shipped on September 9.
Here is the part worth understanding.
LDK's authors can't push that fix to you.
Every wallet and payment app built on the toolkit has to notice the release, download it, and rebuild their own app.
Some will this week. Some won't for months. Some never will.
The same absence of a boss that protects your bitcoin from seizure means a known bug can sit live in someone's wallet long after the patch exists.
That's the price of money nobody controls. No central switch. No forced update. No recall notice.
1 source
- Critical Bitcoin Lightning bugs exposed nodes to fund theft and restart failure · cryptoslate.com · T2